From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.0 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id F3551C433E0 for ; Wed, 22 Jul 2020 13:09:10 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id CDD2B20717 for ; Wed, 22 Jul 2020 13:09:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730685AbgGVNJJ (ORCPT ); Wed, 22 Jul 2020 09:09:09 -0400 Received: from youngberry.canonical.com ([91.189.89.112]:37182 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726146AbgGVNJJ (ORCPT ); Wed, 22 Jul 2020 09:09:09 -0400 Received: from 1.general.cking.uk.vpn ([10.172.193.212] helo=localhost) by youngberry.canonical.com with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1jyEUZ-0003On-AS; Wed, 22 Jul 2020 13:09:03 +0000 From: Colin King To: Michael Tretter , Pengutronix Kernel Team , Mauro Carvalho Chehab , Hans Verkuil , linux-media@vger.kernel.org, devel@driverdev.osuosl.org Cc: kernel-janitors@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH][next][V2] media: allegro: fix potential null dereference on header Date: Wed, 22 Jul 2020 14:09:03 +0100 Message-Id: <20200722130903.818041-1-colin.king@canonical.com> X-Mailer: git-send-email 2.27.0 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Colin Ian King The pointer header is an alias to msg and msg is being null checked. However, if msg is null then header is also null and this can lead to a null pointer dereference on the assignment type = header->type. Fix this just using header->type after the null check and removing the need for type as it is only used once. Addresses-Coverity: ("Dereference before null check") Fixes: 3de16839669f ("media: allegro: add explicit mail encoding and decoding") Signed-off-by: Colin Ian King --- V2: remove need for variable type, as suggested by Michael Tretter --- drivers/staging/media/allegro-dvt/allegro-mail.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/staging/media/allegro-dvt/allegro-mail.c b/drivers/staging/media/allegro-dvt/allegro-mail.c index 4ac65de12463..9286d2162377 100644 --- a/drivers/staging/media/allegro-dvt/allegro-mail.c +++ b/drivers/staging/media/allegro-dvt/allegro-mail.c @@ -462,13 +462,12 @@ allegro_dec_encode_frame(struct mcu_msg_encode_frame_response *msg, u32 *src) ssize_t allegro_encode_mail(u32 *dst, void *msg) { const struct mcu_msg_header *header = msg; - enum mcu_msg_type type = header->type; ssize_t size; if (!msg || !dst) return -EINVAL; - switch (type) { + switch (header->type) { case MCU_MSG_TYPE_INIT: size = allegro_enc_init(&dst[1], msg); break; -- 2.27.0